一 监控原理

$ /bin/netstat -an|awk ‘/^tcp/{++S[$NF]}END{for(a in S) print a,S[a]}‘

TIME_WAIT 3464

FIN_WAIT1 31

FIN_WAIT2 3

ESTABLISHED 12

SYN_RECV 6

CLOSING 8

LISTEN 7

可以使用man netstat查看TCP的各种状态信息描述

ESTABLISHED       socket已经建立连接

CLOSED            socket没有被使用，无连接

CLOSING           服务器端和客户端都同时关闭连接

CLOSE_WAIT        等待关闭连接

TIME_WAIT         The socket is waiting after close to handle packets still in the network. 表示收到了对方的FIN报文，并发送出了ACK报文，等待2MSL后就可回到CLOSED状态

LAST_ACK          The remote end has shut down, and the socket is closed. Waiting for acknowledgement. 远端关闭，当前socket被动关闭后发送FIN报文，等待对方ACK报文

LISTEN            监听状态

SYN_RECV          接收到SYN报文

SYN_SENT          已经发送SYN报文

FIN_WAIT1         The socket is closed, and the connection is shutting down

FIN_WAIT2          Connection is closed, and the socket is waiting for a shutdown from the remote end.

2.监控脚本编写

本文出自 “Linux SA John” 博客，请务必保留此出处http://john88wang.blog.51cto.com/2165294/1586234

使用zabbix监控TCP连接状态